Privacy

What skrat.im stores about links, clicks and accounts, what it does not store, and why it uses no tracking cookies.

Updated: 11 Oct 2026

This page describes what personal data skrat.im (and krat.im, run by the same system) processes, why, on what legal basis and for how long. It is the information required by Article 13 of Regulation (EU) 2016/679 (GDPR). It is written for people, not lawyers. The Slovak version is the binding one.

Controller

The service is operated by, and the controller of personal data is:

For data protection matters write to [email protected] or by post to the registered office. We have not appointed a data protection officer because the GDPR does not require one for processing of this scope.

When a link is created we store the destination address, the alias, the domain, the creation time and optionally a name, an expiry date, a click limit and a password (as a hash only, never the password itself). Without an account we also store a hash of the secret token used to manage the link. The token itself stays in your browser (localStorage) and is never sent anywhere else.

We also store a hash of the creator’s IP address (derived with a server secret, not reversible). It is used only to disable all links from the same source in case of abuse (phishing, spam). The IP address itself is not stored in the database. To limit how many links one source can create, the server keeps it in memory for at most 24 hours. The full IP address also appears in the server logs (see below).

Destination addresses are checked against Google Safe Browsing when a link is created. Google receives the destination address, not data about you. The forms that work without an account (shortening a link and reporting abuse) are protected by Cloudflare Turnstile, which checks that a human is sending them.

Clicks

On every redirect we record: the time, the country (from the Cloudflare header, country level only), the referring site’s domain, the device type, the browser and operating system family, and whether the visitor was a bot. To estimate unique visitors we store a hash that changes daily, derived from the IP address and browser. It changes every day and cannot be reversed to an IP address or joined across days.

In the statistics we do not store the IP address, precise location, the full browser user-agent string, or anything that identifies a specific person. We use no cookies to track people who click. The redirect sets no cookie.

Link statistics are public by default on the preview page (the link with a + at the end). The owner can hide them.

Account

An account is optional. On sign-in we store the email address, the language and the time of the last sign-in. Sign-in tokens (magic links) are stored as hashes only, are single-use, are valid for 15 minutes and are deleted within a day. API keys are stored as hashes only.

If we disable a link from your account, we email you a statement of reasons. You can delete the account in the settings. All links, keys, clicks and sign-in tokens are deleted with it. Activity log entries stay for at most a year (see below).

Cookies and browser storage

We set only two cookies. Both are strictly necessary for the site to work, so they need no consent:

Without an account your browser keeps the list of your links and the tokens to manage them in localStorage. They stay with you until you delete them. On forms used without an account, Cloudflare Turnstile stores a technical value for bot detection in browser storage on its own domain challenges.cloudflare.com. This is a security measure strictly necessary to protect the form. We use no tracking or advertising cookies.

Abuse reports

For a report we store the reported link, the reason, the description, the language of the form and optionally the reporter’s name and email. If the report includes an email address, we send a confirmation of receipt there and later the outcome of the review. Reports are kept for at most one year.

Activity log

Every change is recorded in an audit log: the time, the kind of action (link created, edited, deleted or disabled, report, sign-in, API key, account deletion), the target and who did it. For an account that is its email address, for an anonymous action only a hash of the IP address, the same as when a link is created. The log helps the operator deal with abuse. It is kept for at most one year, even after the account or link is deleted.

Server logs

For every request the web server writes a technical record: the time, the IP address, the country, the page address, the status code, the referring page and the browser (user agent). The logs are used to fix errors and handle attacks and abuse of the service. They are kept for 30 days in the central log store. On the server itself they are written to files of fixed size and the oldest records are continuously overwritten by newer ones.

Providing data is neither a statutory nor a contractual requirement. Without a destination address, however, you cannot create a link, and without an email address you cannot create an account. Everything else works without an account.

Who receives the data

We give data to public authorities only when the law requires it. The database and the application run on our server in the European Union. We do not sell data or share it with anyone else.

Transfers outside the EU

Cloudflare and Google are based in the USA, so data may reach them outside the European Economic Area. Both companies are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has decided that it ensures an adequate level of protection. We will send you details of these safeguards on request.

Automated decisions

We do no profiling and make no decisions about you based solely on automated processing with legal or similarly significant effects. We automatically reject only destination addresses that Google Safe Browsing flags as harmful, requests over the limits and submissions that Turnstile judges to be a bot. We disable links for abuse ourselves with the help of automated tools. If you disagree with a link being disabled, write to us and a human will review the decision.

Retention

Your rights

Under the GDPR you have the right:

You manage links and the account directly in the app. For anything else write to [email protected]. We reply without undue delay and within one month at the latest. For anonymous links we can verify you only by the token that manages them, we hold no other data about you.

If you believe we handle your data unlawfully, you can lodge a complaint with the supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk. You can also turn to the supervisory authority in the country where you live or work.

Changes

This page may be updated. The date of the last change is shown in the header. Significant changes are announced on the home page.